CVE-2026-94111

Executive Summary

CVE-2026-94111 is an authentication bypass vulnerability in Tencent BrowserSkill through version 0.3.0. The flaw resides in the origin validation logic of the product's local daemon WebSocket interface, which improperly accepts any Chrome extension origin string consisting of exactly 32 characters in the range a–p. A local attacker who registers a malicious browser extension can connect to the daemon as a legitimate browser client and intercept or manipulate page content, DOM, and screenshots relayed to the AI agent. No public exploit or vendor patch is currently available.

Technical Analysis

The vulnerability class is CWE-346, Origin Validation Error. Tencent BrowserSkill exposes a local daemon that communicates with browser-side components over a WebSocket channel. As part of the WebSocket handshake, the daemon is expected to validate the Origin header against a strict allowlist of trusted Chrome extension origins (typically chrome-extension://<32-character-extension-id>).

The NVD description states the validation accepts "any chrome-extension origin with 32 characters in range a-p." This indicates that the origin check is implemented as a character-class/length predicate rather than an equality check against a known trusted extension ID. Chrome extension IDs are 32 lowercase alphabetic characters historically drawn from the a–p range (a base-16 hex encoding of the extension's public key hash). Consequently, the flawed check collapses to "length == 32 and all chars within [a-p]," which matches every possible extension origin, including attacker-controlled ones.

Because the check does not bind the origin to a specific trusted extension ID, the daemon's authentication boundary is effectively removed. Any locally installed extension can present a syntactically valid 32-character a–p origin and be treated as the trusted browser client. This is an authentication bypass rooted in insufficient origin binding, not a memory-safety or injection flaw.

The attack surface is the local WebSocket listener of the daemon. The CVSS vector (AV:L, PR:L, UI:N) reflects that exploitation requires local access and low-privilege capability — i.e., the ability to register a browser extension — with no user interaction beyond normal extension installation. Impact subscores show low confidentiality (C:L), high integrity (I:H), and low availability (A:L), consistent with tamper-oriented access to content/DOM/screenshot data rather than full system compromise.

Insufficient technical detail is available regarding the exact handshake message format, the daemon's internal validation function names, or the WebSocket URL path. These are intentionally not speculated here.

Exploitation Scenarios

The following attack chain is inferred from the vulnerability class and the NVD description; no public PoC exists.

1. Reconnaissance/target identification. The attacker obtains local access to a host running Tencent BrowserSkill (<= 0.3.0) and confirms the daemon's local WebSocket interface is present. The attacker identifies the daemon's listening endpoint (local only per AV:L).

2. Triggering the flaw class. The attacker develops and registers a malicious Chrome extension. Because the daemon accepts any origin matching "32 characters in range a–p," the attacker's extension — which naturally has a valid 32-character a–p extension ID — passes origin validation. No knowledge of the trusted extension's ID is required.

3. Payload/execution. The attacker's extension connects to the local daemon WebSocket as if it were the legitimate browser client. It then participates in the browser-client protocol, receiving or injecting data that the daemon relays to/from the AI agent.

4. Post-exploitation impact. Per the description, the attacker can "intercept and manipulate page content, DOM, and screenshots returned to the AI agent." This enables tampering with the AI agent's visual and textual inputs — e.g., altering rendered content presented to the agent, forging screenshot data, or injecting DOM content — potentially steering the agent's decisions. No public PoC available; attack chain is inferred from vulnerability class.

Impact Assessment

The blast radius is limited to hosts where BrowserSkill's daemon runs and where an attacker can install a browser extension — matching the AV:L/PR:L context. Integrity impact is high (I:H): an attacker can alter page content, DOM, and screenshots delivered to the AI agent, undermining the trustworthiness of all agent-received data. Confidentiality is low (C:L) and availability low (A:L), as the flaw is oriented toward tampering rather than broad data exfiltration or denial of service. Business impact centers on AI agent decision integrity: if agents act on manipulated content or screenshots, downstream automated actions, summarization, or workflow triggers may be corrupted. Because the flaw is unpatched and requires no user interaction (UI:N), any environment deploying affected versions with third-party extension capability is at risk.

Detection Guidance

Sigma Rule

title: Suspicious Chrome Extension Origin WebSocket Handshake to BrowserSkill Daemon
id: 3f7c9a1e-2026-4b7e-9c11-94111aabbccd
status: experimental
description: Detects WebSocket connections to the local BrowserSkill daemon whose Origin header is a generic chrome-extension origin, indicating possible CVE-2026-94111 exploitation.
logsource:
  category: network_connection
  product: windows
detection:
  selection_origin:
    Initiated: 'true'
    DestinationPort: 0
    Origin|startswith: 'chrome-extension://'
  selection_daemon:
    DestinationIp|cidr:
      - '127.0.0.0/8'
      - '::1/128'
  condition: selection_origin and selection_daemon
fields:
  - Image
  - DestinationIp
  - DestinationPort
  - Origin
falsepositives:
  - Legitimate trusted browser extension connecting to the daemon
level: medium
tags:
  - attack.t1190
  - cve.2026.94111

YARA Rule

rule CVE_2026_94111_BrowserSkill_Origin_Bypass
{
    meta:
        description = "Detects code referencing BrowserSkill daemon WebSocket origin validation with chrome-extension origin handling"
        author = "Threat Intelligence"
        reference = "CVE-2026-94111"
        date = "2026-01-01"
        severity = "medium"

    strings:
        $ws = "ws://127.0.0.1" ascii nocase
        $origin = "chrome-extension://" ascii nocase
        $daemon = "BrowserSkill" ascii nocase

    condition:
        uint32(0) == 0x464c457f or uint16(0) == 0x5a4d and
        ($origin and ($ws or $daemon))
}

Suricata IDS Rule

alert tcp $HOME_NET any -> $HOME_NET any (msg:"CVE-2026-94111 Tencent BrowserSkill Daemon WebSocket Origin Bypass Attempt"; flow:to_server,established; content:"Upgrade|3a 20|websocket"; nocase; http_header; content:"Origin|3a 20|chrome-extension://"; nocase; http_header; pcre:"/Origin\x3a\x20chrome-extension:\/\/[a-p]{32}/Hi"; classtype:attempted-user; reference:cve,2026-94111; reference:url,https://nvd.nist.gov/vuln/detail/CVE-2026-94111; sid:202694111; rev:1; metadata:created_at 2026_01_01, updated_at 2026_01_01;)

Elastic Detection

network where
  destination.ip in ("127.0.0.1", "::1") and
  event.action == "connection_started" and
  process.name != null and
  network.transport == "tcp"

Splunk SPL Query

index=network OR index=proxy (dest_ip IN ("127.0.0.1","::1"))
| search (http_headers_Origin="chrome-extension://*" OR url="*chrome-extension://*")
| regex http_headers_Origin="chrome-extension://[a-p]{32}"
| stats count values(http_headers_Origin) as origins by src_ip dest_ip dest_port process_name
| where count > 0

Wazuh OSSEC Rule

<group name="browserskill,cve-2026-94111,">
  <rule id="202694111" level="10">
    <decoded_as>json</decoded_as>
    <field name="Origin">^chrome-extension://[a-p]{32}$</field>
    <field name="DestinationIp">^127\.0\.0\.1$|^::1$</field>
    <description>CVE-2026-94111: Possible BrowserSkill daemon WebSocket origin bypass via generic chrome-extension origin.</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>authentication_bypass,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate mitigations

   • Restrict installation of untrusted browser extensions on hosts running the BrowserSkill daemon (enforce extension allowlisting via enterprise browser policy).
   • Where feasible, disable or restrict the local daemon's WebSocket listener until a fix is available; run the agent only when browser integration is strictly required.
   • Monitor local WebSocket connections for chrome-extension:// origins and alert on any origin that is not the explicitly trusted extension ID.

2. Patch/upgrade steps

   • No vendor patch is available. Track Tencent's BrowserSkill release notes and upgrade beyond 0.3.0 as soon as a fixed version ships.
   • Do not rely on a specific patch version; verify the origin-validation logic now enforces exact extension-ID matching post-upgrade.

3. Long-term hardening

   • Replace character-class/length origin predicates with exact allowlist comparison against the trusted extension ID.
   • Add mutual authentication (per-session tokens or OS-level local IPC peer verification) to the daemon/extension channel so origin alone is not the sole trust anchor.
   • Apply least-privilege to agent hosts and audit extension manifests and origins continuously.

References

• NVD — CVE-2026-94111: https://nvd.nist.gov/vuln/detail/CVE-2026-94111
• CWE-346 Origin Validation Error: https://cwe.mitre.org/data/definitions/346.html
• MITRE ATT&CK T1190 — Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/
• Google Chrome extension ID / origin format documentation: https://developer.chrome.com/docs/extensions/
• Tencent BrowserSkill project page (vendor tracking; no advisory currently published)

No threat actor campaigns or exploit-in-the-wild evidence are currently known for this CVE. CISA KEV: NO.